Patent literature 1 discloses an example of an operations management system which performs system modeling by using time series information on system performance and detects a failure of the system by using the generated model.
The operations management system disclosed in patent literature 1 generates a correlation model including a plurality of correlation functions, by deriving a correlation function with respect to every pair between pieces of performance information on plurality of performance items based upon time series information of the performance information on a plurality of performance types of the system. Then, the operations management system determines whether the correlations are destructed or not by using the generated correlation model, with respect to actual measurement values of performance information, and detects an abnormality of the system based upon the number of occurrences of correlation destruction.
In the operations management system disclosed in patent literature 1, when generating a correlation model, time series information on performance information during a predetermined period of time is inputted and correlations are extracted based upon the time series information in that period.
By the way, in many systems, because the number of processing servers and executed applications are changed depending on the time slot of system operation, the system characteristics also change, and the correlations between pieces of performance information vary according to the characteristics. Due to this, a time period (modeling period) of the time series information used to generate a correlation model needs to be set appropriately according to times of change in the system characteristics. Further, when analyzing the system, it is necessary to use a correlation model according to the system characteristics of the time slot during which the analysis is performed.
For example, the type of processes performed by accounting systems changes between daytime and nighttime such as that they perform on-line transaction processes in the daytime and batch processes at night. With respect to such accounting systems, it is necessary to generate respective correlation models for daytime and nighttime, on the basis of respective series of performance information for daytime and nighttime, and to change the correlation model to be used in the system analysis between daytime and nighttime.
Thus, in order to perform modeling and analysis according to the system characteristics, it is necessary to have the information on a modeling period with respect to each of a plurality of system characteristics the system has.
Such information on a modeling period is grasped, for example, by an administrator with sufficient knowledge about the system, and the administrator sets a modeling period for which a correlation model is generated.
However, when such information on a modeling period is not available, due to the reason such as that an administrator with sufficient knowledge about the system does not exit, for example, and thereby a correlation model is generated with respect to incorrect modeling period and is applied to a system analysis, an abnormality of the system is incorrectly detected (as misinformation) despite that the system is in normal operation, due to that the correlations between pieces of performance information varies depending on the time slot.
Additionally, when a system analysis is performed using a correlation model, during a time slot where the system characteristics are different from that in the modeling period of the correlation model, an abnormality of the system is incorrectly detected (as misinformation) similarly, due to that the correlations between pieces of performance information in the time slot of the analysis is different from that in the modeling period.
For example, with respect to the above-mentioned accounting systems, when a correlation model generated on the basis of series of performance information in the daytime is applied to a system analysis in the nighttime, an abnormality of the system (misinformation) is reported to an administrator even if batch processes are normally performed, due to the variation in the correlations established in the system.
As described above, when information on the modeling period is not available with respect to each of a plurality of system characteristics the system has, an inaccurate model may be generated, or a model inappropriate for the time slot of the system analysis may be applied. Due to that, there is a possibility that degradation in accuracy of the analysis, missing of a failure in the analysis or misinformation on a failure occur.
As a related art, patent literature 2 discloses an operations information management system, wherein correlation coefficients are calculated between performance information and model data of monitored targets, and only the correlation coefficients are stored with respect to the performance information showing strong correlation.